Handling Subject Access Requests (SARs) – Guidance for Grassroots Football Clubs

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, all football clubs that collect or store personal information must respond to Subject Access Requests (SARs). This includes grassroots and amateur clubs.

What is a Subject Access Request (SAR)?

A SAR is a formal request from an individual (or their representative) for access to the personal data your club holds about them. This includes:

• Confirmation that you process their data
• A copy of the data itself
• Information about how the data is used

Who Can Make a SAR?

Any individual (player, coach, volunteer, parent) can submit a SAR. A third party, such as a parent or legal representative, may also act on their behalf, but clear authorisation must be provided.

How Long Do We Have to Respond?

You must respond within 30 calendar days of receiving the request. If needed, you can request clarification or identity verification, but you must still act promptly.

What Type of Data Might Be Included?

Relevant personal data may include:

• Emails or correspondence mentioning the individual
• Safeguarding notes (subject to review and redaction)
• Whole Game System, Club Portal, or Matchday App records
• Notes from meetings, disciplinary matters or internal reports
• WhatsApp or informal messaging (if used for club business)

Redacting and Withholding Data

Before sharing information, make sure to:

• Redact third-party personal data (e.g. names or contact details of others)
• Consider exemptions for safeguarding or confidentiality risks

How to Deliver the Response

Data should be sent securely – preferably as a password-protected PDF or encrypted file. Include a brief covering note summarising what is included and what has been withheld or redacted.

Logging and Best Practice

• Keep a record of all SARs received
• Note what data was shared and how
• Retain copies of redactions or decisions

Need Help?

Contact Staffordshire FA for support with templates, redactions, or GDPR queries:
Email: support@staffordshirefa.com

For more general information on SARs, visit the Information Commissioner’s Office: www.ico.org.uk